PT-2006-6651 · Vmware · Vmware Virtualcenter Client

Publicado 2006-11-21 · Atualizado 2018-10-17 · CVE-2006-5990

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions VMWare VirtualCenter client versions 1.4.x through 1.4.1 (before Patch 1, Build 33425) VMWare VirtualCenter client versions 2.x through 2.0.1 (before Patch 1, Build 33643)

Description The issue allows remote malicious servers to spoof valid servers via a man-in-the-middle attack when server certificate verification is enabled. This occurs because the client does not verify the server's X.509 certificate when creating an SSL session.

Recommendations For VMWare VirtualCenter client versions 1.4.x through 1.4.1 (before Patch 1, Build 33425), apply Patch 1 (Build 33425) to resolve the issue. For VMWare VirtualCenter client versions 2.x through 2.0.1 (before Patch 1, Build 33643), apply Patch 1 (Build 33643) to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2006-5990

Produtos afetados

Vmware Virtualcenter Client

Referências · 10

• http://secunia.com/advisories/23053 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-5990 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30477 · Nota
• http://kb.vmware.com/kb/4646606 · Nota
• http://securityfocus.com/archive/1/452275/100/0/threaded · Nota
• http://vmware.com/download/vi/vc-201-200611-patch.html · Correção
• http://securityfocus.com/bid/21231 · Nota
• http://vupen.com/english/advisories/2006/4655 · Aviso do Fabricante
• http://securitytracker.com/id?1017270 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5990 · Nota